It depends on whether or not the order is known... for instance, if the attacker knew that they had words 1-21 or 4-24 (ie. the first 21 or the last 21 words) and were simply trying to find the missing 3 words... then the number of possible combinations would only be:

2048 * 2048 * 2048 = 8,589,934,592

Which really isn't a lot at all... and a simple script would crack that in minutes.

However, if the attacker had no clue as to the position of the missing words... ie. you'd taken 3 words from position 3, 17 and 23, but there was no indication of position/order of words on the paper (ie. they're not numbered)... then things become a lot more complicated. The number of combinations the attacker would need to test increases by several orders of magnitude and it would require a lot more work. It's possible the time required would extend to hours or days or years. I'm not not sure of the actual math... possibly something like:

(2048 * 24) * (2048 * 24) * (2048 * 24) = 118,747,260,000,000+ combinations (note, I'm very tired, so this math is probably really wrong )

Having said that... if you knew that your 21 words had been compromised, you should immediately generate a new seed and move all coins from the old wallet to the new one and then "burn" the old wallet/seed...



There are 2048 words for BIP39 seeds: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt